How to offboard non-domain computers from Microsoft Defender for Endpoint without running a script directly?

Hello Melissa

1. Create a Device Security Policy: - In the Microsoft 365 Security Center, go to "Devices" and then "Policies & Profiles." - Create a new policy with the following settings: - Platform: Windows - Enrollment Type: MDM enrolled - Configuration Profiles: Windows Defender Antivirus - Apply this policy to a security group that includes all your domain-joined computers.
2. Enable Conditional Access based on the Device Security Policy: - In the Azure portal, go to "Azure Active Directory" and then "Security." - Set up a Conditional Access policy that requires devices to comply with the Device Security Policy. - This will ensure that only domain-joined computers with the Device Security policy applied will have access to MDE.
3. Script to offboard personal computers: - Create a PowerShell script that runs on personal computers and removes them from MDE. - The script should use the MDE PowerShell module to connect and remove the device from MDE. - You can use the following command in your script: Remove-MpPreference -RemoveAllSettings -Force
4. Deploy the script to personal computers: - Use a software distribution tool like Intune or third-party solutions to deploy the script to personal computers. - Ensure that the deployment is targeted only to personal computers. - Once the script runs, it will remove the personal computers from MDE.

@Melissa Ray, Thanks for posting in Q&A. From your description, it seems you want to offboard the windows which is not AD and not managed by Intune. For such device, based on my researching, it can be offboard by local script which is mentioned in the following link:

https://video2.skills-academy.com/en-us/microsoft-365/security/defender-endpoint/configure-endpoints-script?view=o365-worldwide#offboard-devices-using-a-local-script

As Microsoft defender for endpoint support is not in Q&A. If you want to get more help, you can contact them by open case with the method in the following link to get help.

https://video2.skills-academy.com/en-us/microsoft-365/security/defender-endpoint/contact-support?view=o365-worldwide

Thanks for your understanding.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

After checking the suggestions and consoling with the support team, I've come to conclude there is currently no available solution to force offboard devices that are out of the organization and have no way to connect to them. If there are no third-party solutions to centralized and distribute the offboarding script, you'd have to do it manually for each computer.

@Gleb Greenspan 's suggestion sounds like a good starting point to prevent any more onboarding of computers that don't belong to the organization using AAD.

What we plan to do next is as follow:

1. Use device groups to find personal devices and computers we don't want to be on MDE.
2. Attempt to contact the computer's owner if possible, using local script for offboarding, as suggested by @Crystal-MSFT . In the Support's response below are also instruction of how an end user can check if the computer has defender for endpoint.
3. If not, we will exclude the device or apply appropriate tags.

The responds I received from the Support team are written below.

 - Can we perform Offboarding for computers who are not in the domain, and we have no access to?

For security purposes, the device will remain in the portal as an historical record for up to 180 days. However, the device's data will be purged according to your configured retention period. 

For security purposes, the device will remain in the portal as an historical record for up to 180 days. However, the device's data will be purged according to your configured retention period.

I.e. The machines will “disappear” from the portal once the machines becomes inactive (they stop sending cyber data and the Sensor health state is 'inactive'), and no later than 180 days since since they stopped sending data to cloud.

- Can we lower the retention period for purging purposes?

No, this is hard-coded in the backend by design, and no way to reconfigure it.

- There is an azure policy called MDE.window/MDE.linux that ran automatically on computers where Defender for servers was activated. What steps do I need to make to offboard the computers?

Steps to removing the extension are documented in this article.

-How can an end user check if the computer has defender for endpoint?

To quickly check if the machine is onboarded check "Windows Defender Advanced Threat Protection Service" under services and also Task Manager > Details > "MsSense.exe". Notice the service's status will remain as stopped.

- Can I reset the whole MDE?

It is only possible with a new Organization ID. Otherwise you can just onboard new devices to the MDE portal.

I hope this answer is comprehensive and provide you with needed information. Thank you for who assisted!

If you can Live Response into the machine you can run the offboarding script from there. Since the Offboarding script is a cmd file, you will need to upload the cmd file and create/upload a ps1 file that calls the cmd file. I tested this from my lab to my home PC. It worked great.